1Z0-1067-25 Question 27
Select 2Your DevOps team is using Ansible with the Oracle Cloud Infrastructure (OCI) Ansible Collection to manage configurations across multiple compartments. You need to deploy a critical security patch only to production compute instances, and you also want to ensure that your Ansible playbooks use OCI instance principals for authentication rather than storing credentials. Which two actions represent recommended best practices to meet these objectives?
- A
Use the OCI Ansible dynamic inventory plugin with the production compartment specified as a filter to discover only production compute instances.
- B
Configure each Ansible inventory file to include all compartments, then manually exclude non-production instances in your playbooks.
- C
Configure and enable instance principals so Ansible can authenticate to OCI without storing credentials in the playbook.
- D
Copy your SSH keys into the production compartment's metadata for each compute instance to authenticate Ansible connections.
- E
Grant each Ansible user full administrative privileges on all resources so you can quickly apply patch updates without permission issues.
Show answer and explanation
Correct answers: A, C
Explanation
Using the OCI Ansible dynamic inventory plugin simplifies targeting production compute resources across compartments. Filtering on the specific production compartment minimizes the chance of accidentally applying changes to non-production resources. Replacing static credentials with OCI instance principals is a recommended approach that removes sensitive data from configuration files and aligns with OCI's best-practice security model. Refer to the official Oracle Cloud Infrastructure documentation on 'Using the OCI Ansible Collection' and 'Configuring Instance Principals' for detailed implementation guidelines.
- A. Correct.
Correct. Using the OCI Ansible dynamic inventory plugin with a compartment filter is a best practice. It keeps your inventory accurate, targets only the desired compartment, and automates instance discovery without manual updates.
- B. Incorrect.
Incorrect. Listing all compartments and manually excluding non-production environments in the playbooks is prone to errors and not efficient. It also undermines the benefit of dynamic inventory filtering.
- C. Correct.
Correct. Enabling instance principals for your Ansible playbooks ensures secure authentication without embedding or transmitting credentials. This follows OCI security best practices and reduces the risk of compromised credentials.
- D. Incorrect.
Incorrect. Storing SSH keys in instance metadata can create security risks if not carefully managed. It is more secure and recommended to perform key-based communication through a centralized, controlled method rather than embedding keys in metadata objects.
- E. Incorrect.
Incorrect. Granting broad administrative privileges on all resources contradicts principles of least privilege. It introduces unnecessary risk and does not specifically address securely patching only production instances.